POSTED FY26 Internal Audit Services - Addendum.pdf

Internal Audit Services 298-RFP-InternalAudit-25

Addendum 1

City of Asheville Project Manager: Lauren Brune

Email Project Manager: lbrune@ashevillenc.gov

Date Issued: April 14, 2025

PROPOSALS DUE BY: Tuesday, April 22, 2025 AT 5:00 p.m.

mailto:lbrune@ashevillenc.gov

ADDENDUM No. 1 Issue Date: April 14, 2025 Project Name: Internal Audit Services Project Number: 298-RFP-InternalAudit-25

TO: Prospective Applicants

This addendum forms a part of the Request for Proposals and modifies the original Proposal 298-RFP-InternalAudit-25 only to the extent specifically noted below and to address questions received. Failure to acknowledge this addendum in the submittal may subject the proposal to be deemed non-responsive.

This Addendum is posted on the City procurement website at www.ashevillenc.gov/bids. This is the official source of this addendum. All addenda and attachments shall be published to the same location.

This Addendum consists of 10 pages in total.

This Addendum is to clarify Requirements from the RFP and address Responses to Questions.

Revised Requirements

The original requirements of the RFP are as follows:

1. The Contractor must provide a statement of independence, as defined in the AICPA’s

Code of Professional Conduct.

2. The Contractor must provide copies of licenses and registrations required for practice in

North Carolina.

3. The Contractor must provide a copy of its most recent peer review.

4. The Contractor must have conducted internal audit services for at least three (3) local governments in the United States, with at least one (1) being in North Carolina, within the last three years.

The requirements are being revised as follows:

1. The Contractor must provide a statement of independence, as defined in the AICPA’s

Code of Professional Conduct. – only required if the contractor is a CPA firm

2. The Contractor must provide copies of licenses and registrations required for practice in

North Carolina.

Firms should refer to the NC SOS website for any registration requirements.

3. The Contractor must provide a copy of its most recent peer review. – only required if the contractor is a CPA firm

4. The Contractor must have conducted internal audit services for at least three (3) local governments in the United States, with at least one (1) being in North Carolina, within the last three years.

http://www.ashevillenc.gov/bids https://www.sosnc.gov/manual/Register_A_Foreign_Business

Answers to Questions

1. Will you consider a firm that has not done internal audit work in NC?

Yes, we will consider a firm that has not performed internal audit work in North Carolina.

However, the firm must have performed internal audit work for several local governments in the past. Firms should refer to the NC SOS website for any registration requirements.

2. The RFP states, "The Contractor must have conducted internal audit services for at least three (3) local governments in the United States, with at least one (1) being in North Carolina, within the last three years." Is this a deal breaker or can we highlight our significant experience with local governments in other states?

We will consider a firm that has not performed internal audit work in North Carolina.

However, the firm must have performed internal audit work for several local governments in the past. Firms should refer to the NC SOS website for any registration requirements.

3. What is the total budget allocated annually for internal audit?

The total budget allocated annually for internal audit is a not-to-exceed contract of $115,000 for the 2025-2026 fiscal year.

4. What were the total hours and fees expended on internal audit in the last 3 fiscal years?

The total hours and fees expended on internal audit in the last 3 fiscal years are as follows:

● 2024-2025: 522 hours; $93,750

● 2023-2024: 62 hours; $18,630

● 2022-2023: 487 hours; $84,200

5. What are the total number of hours expected to be expended on internal audit each year during the term of this contract?

The total number of hours expected to be expended on internal audit each year during the term of this contract will be up to the selected firm. There is a not-to-exceed budget allocated to the contract each year, as well as one FTE (full-time equivalent) in-house employee, the Internal Audit Program Manager, devoted to supporting the contract.

6. Are there any specific audit units the County expects to be audited in the first year of this contract?

No; development of the annual audit plan would be a collaboration between the selected firm, the City Manager's Office (CMO), and the Finance Department, but would also be based on the Citywide Risk Assessment completed in 2023.

7. It appears the City trends for 3 to 4 internal audits per year. Is this number of internal audits per year expected to remain consistent?

Yes

8. Do you currently utilize a GRC (Governance, Risk, and Compliance) software product? If so, could you please specify which product is in use?

No, we do not currently utilize a GRC software product.

9. Will the City entertain limited contract modifications or proposed redlines submitted alongside the proposal?

Yes, they will be considered by our City Attorney's Office.

10. What were the strengths and weaknesses of your current/former internal audit service provider?

Answers in this addendum are intended to address and clarify any questions about the RFP itself, rather than to comment on the performance of prior vendors.

5. Were there any previously issued RFPs tied to internal audit services? What were the total hours and budget for that engagement?

Yes, there was an RFP for internal audit services in 2024. The total hours for that engagement were 583 and the budget was $95,280.

6. What is the City’s projected budget in terms of dollars to complete the scope of work?

The total budget allocated annually for internal audit is a not-to-exceed contract of $115,000 for the 2025-2026 fiscal year.

7. As stated during the pre-proposal meeting, will proposals from non-CPA firms be considered?

Yes

8. As stated during the pre-proposal meeting, will proposals involving out-of-state contractors and/or subcontractors be considered?

Yes; firms should refer to the NC SOS website for any registration requirements.

9. Does the City believe that this work can be completed virtually?

Yes, the majority of the internal audit engagements can be completed virtually. However, occasional site visits and in-person meetings may be warranted. These travel costs should be included in the cost proposal.

10. Per the Requirements section, it states that: The Contractor must provide copies of licenses and registrations required for practice in North Carolina. For firms based outside of North Carolina, what licenses and/or registrations will be required (i.e., State business registration, professional licenses, etc.)?

Firms should refer to the NC SOS website for any registration requirements.

11. Per the Requirements section, it states that: The Contractor must have conducted internal audit services for at least three (3) local governments in the United States, with at least one (1) being in North Carolina, within the last three years. As stated during the pre-proposal meeting, for firms who have not performed an internal audit service engagement in North Carolina, will this requirement be waived?

We will consider a firm that has not performed internal audit work in North Carolina.

However, the firm must have performed internal audit work for several local governments in the past. Firms should refer to the NC SOS website for any registration requirements.

https://www.sosnc.gov/manual/Register_A_Foreign_Business

12. Are there any specific business licenses that the City requires (or prefers) proposers to have? If yes, please list those licenses and the name of the organization that issues them.

Firms should refer to the NC SOS website for any registration requirements.

13. Are there any specific business licenses that the City requires (or prefers) subcontractors to have?

Firms should refer to the NC SOS website for any registration requirements.

14. Are there any specific personal certifications that the City requires (or prefers) proposers to have? If yes, please list those licenses and the name of the organization that issues them.

None required

15. Per MWBE Utilization Commitments, will MWBEs that are outside of North Carolina be considered towards this RFP's MWBE participation goals?

Yes; MWBEs that are outside of North Carolina are welcomed and can be considered toward this RFP's MWBE participation goals. If the MWBE who will be subcontracted is not MWBE Certified through the City of Asheville, a copy of their MWBE Certification is to be included with the RFP submission. This MWBE Certification can include MWBE Certifications from the State that the MWBE has received it from and or, any Federal MWBE Certifications the MWBE has obtained.

16. Per MWBE Utilization Commitments, under the MWBE Participation Goal form, it appears that a dollar value and a percent of contract needs to be provided. Considering that the RFP cost proposal only requires hourly rates that will be charged per job position/title classification, will a percentage of contract suffice?

The MWBE Utilization Commitment page requires the minimum amount the prime contractor will expend in subcontracting. The RFP does require hourly rates that will be charged per the job position/title classification. In this case of the hourly rates, the Utilization Commitment page requires the anticipated "minimum" dollar amount AND the percentage of the contract to be explicitly reflected on the Utilization Commitment page.

Both the minimum subcontracting dollar amount commitment spend and percentage are required to be reflected on the ABI forms.

25. Has the drafted Internal Audit Policy been implemented?

Yes, an internal audit policy is in place and was last updated in July 2024.

26. What was the size of the annual Internal Audit plans (over the last two years) in hours?

The total hours and fees expended on internal audit in the last 3 fiscal years are as follows:

● 2024-2025: 522 hours; $93,750

● 2023-2024: 62 hours; $18,630

● 2022-2023: 487 hours; $84,200

27. How many hours were allocated to IT Audit in this year’s IA Plan? Do you anticipate more or fewer IT Audit hours for the next plan year?

The 2024 Internal Audit plan did not allocate any hours to IT audit. However, IT may be a focus for an internal audit project in Fiscal Year 2025-26.

28. Is your IT organization 100% in-house, or is it a hybrid model with multiple service provider(s)?

Our IT organization is internal to the City of Asheville organization.

29. What ratio are your IT Systems in the cloud versus in-house managed systems?

At the moment the City has roughly 45% of IT systems as SaaS, or hosted in the cloud by a third party. We have 35% managed on premises with 20% hosted in our self-managed AWS cloud.

30. Does the Audit Committee anticipate that the IA plan coverage will increase or decrease over the contract period?

The City's internal audit plan should initially be guided by the latest risk assessment performed in 2023. This will be the first document we reference. New potential projects may be identified by either executive management or the Finance management team.

Future risk assessments may be performed but none are anticipated in the next calendar year.

31. Can you give us an example of the type of consulting services that have been conducted or may be contemplated?

The consulting services mentioned in the RFP may include initiatives such as process improvements or best practice recommendations.

32. What are your initial thoughts on the scope of audit services required to be performed under the Government Auditing Standards or the Uniform Guidance?

There is not currently an audit plan in place for Fiscal Year 2025-26, nor are there specific departments or areas already identified as priorities for internal audit. As stated in the RFP, all internal audit work is expected to be conducted under the listed professional standards as appropriate.

33. The RFP states: "The Contractor may also be required to perform services that are considered non-audit services as defined by Generally Accepted Government Auditing Standards as well as consulting services as defined by the International Standards for the Professional Practice of Internal Auditing." Is the expectation that we would include a “bucket” of hours to be used for this or should we plan on that being priced outside the core body of work?

Either approach would be acceptable; the cost proposal should specify hourly rates for each team member by position or title classification. If the hourly rates would be different for core audit vs. non-audit services, that should be made clear in the cost proposal.

34. What audits are currently slated for the upcoming 2025-2026 audit plan?

There is not currently an audit plan in place for Fiscal Year 2025-26, nor are there specific departments or areas already identified as priorities for internal audit.

35. How many audits are expected to be performed each year?

Ideally, four (4) audit projects would be performed in a fiscal year.

36. How many audits will the audit department be handling internally and how many are expected to be co-sourced/outsourced?

All internal audit projects identified in the annual audit plan will be co-sourced to the selected provider.

37. What will be the criteria for determining which are handled internally vs.

co-sourced/outsourced?

See above

38. Is there a maximum bid threshold? If so, please provide.

There is no maximum bid threshold. However, the total budget allocated annually for internal audit is a not-to-exceed contract of $115,000 for the 2025-2026 fiscal year.

39. What are the total number of hours anticipated annually for consulting services and outsourced/co-sourced audit personnel?

There is no specific number of hours the City anticipates needing annually.

40. May the proposal include an annual increase after the first and/or second year to adjust for staff hourly rate increase and additional hours (if needed)?

The proposal can include fee increases after year 1 if known. These can also be a point of discussion upon renewal of the contract after the first year. Any changes to the price at the time of renewal would require an amendment to the contract.

41. In the cost proposal section of the RFP, are you requesting only a rate card by job position/title or are you requesting us to price out an estimated total cost per audit? (i.e.

ARA, IAP, individual audits) Since the number of required hours per audit will vary, an hourly rate listing by job position (including all personnel who will participate in the audits) will be sufficient.

However, please also include any other miscellaneous costs, such as data storage costs to retain all working papers and audit reports as specified in the RFP.

42. Do you have an established budget and if so, could you please share that amount?

The total budget allocated annually for internal audit is a not-to-exceed contract of $115,000 for the 2025-2026 fiscal year.

43. How many audits (exclusive of the ARA and IAP) were performed last year? On average, how many audits are performed yearly?

Two (2) internal audit projects were completed during 2024 due to setbacks with staff availability and Hurricane Helene. Ideally, four (4) audit projects would be performed in a fiscal year.

44. How many audits should be expected for the year as a result of the ARA and IAP?

Ideally, four (4) audit projects would be performed in a fiscal year.

45. Have you used a co-sourced/outsourced partner previously or is this new for 2025 – 2027?

The first co-sourced provider for internal audit services was for the 2024 calendar year.

46. What have been key challenges historically during the audit planning process and while executing audits?

Some key challenges with the City's internal audit program have included prioritizing audit projects based on the 2023 risk assessment; working with already busy and time-constrained City staff to provide information and schedule meetings and site visits;

and presenting audit findings to the public in an understandable but accurate way.

47. Are there any specific qualities that are expected of a consulting partner?

We would look for a consulting partner with experience with local government clients, who can understand the unique challenges faced by municipalities in North Carolina. We need a provider that is efficient with City staff time, thorough in their review of the selected operation, and professional in their deliverables and presentations to the public.

48. Will the awarded partner/consultant be the sole provider of the audit plan, or could multiple service providers be used for specific audits?

All internal audit projects identified in the annual audit plan will be co-sourced to the selected provider.

Current Internal Audit Structure

1. Was there a previous co-source service provider?

Yes, there was a co-sourced provider for internal audit services in 2024.

2. What is the anticipated start date of the engagement? Is it July 1, 2025, or another date?

Yes, the anticipated start date for the engagement is July 1, 2025.

3. Is there an internal audit charter currently in place? If yes, has it been updated for the new standards?

Yes, an internal audit policy is in place and was last updated in July 2024.

4. Will the co-sourced service provider have a reporting relationship with Executive Leadership and the City Commissioners?

Yes, the co-sourced service provider will have a reporting relationship with the City Manager's Office and with City Council via quarterly meetings of the Audit Committee.

5. What is the Governance structure for the agency? Is there an audit committee?

Yes, there is an Audit Committee which meets virtually on a quarterly basis. More information can be found on the City website.

Expectations and Scope

1. Is there a risk assessment and audit plan already created for the upcoming year?

https://www.ashevillenc.gov/department/city-clerk/boards-and-commissions/audit-committee/

There is a risk assessment that was completed in February 2023, which can be used in discussion with Internal Audit staff to determine the annual audit plan. There is not currently an audit plan in place for Fiscal Year 2025-26.

2. How many audit projects are typically performed in a fiscal year?

Ideally, four (4) audit projects would be performed in a fiscal year.

3. What is the City's expected annual budget range for these services?

The total budget allocated annually for internal audit is a not-to-exceed contract of $115,000 for the 2025-2026 fiscal year.

4. Is there a specific number of hours or projects the City anticipates needing annually?

Ideally, four (4) audit projects would be performed in a fiscal year. There is no specific number of hours the City anticipates needing annually.

5. Are there specific departments or areas that the City has already identified as priorities for internal audit?

There is a risk assessment that was completed in February 2023, which can be used in discussion with Internal Audit staff to determine the annual audit plan. There are no specific departments or areas already identified as priorities for internal audit in Fiscal Year 2025-26.

6. Should our proposal include fee increases after year 1?

The proposal can include fee increases after year 1 if known. These can also be a point of discussion upon renewal of the contract after the first year. Any changes to the price at the time of renewal would require an amendment to the contract.

Working Arrangements

1. Would City staff be available to support the audit projects to help manage costs? If yes, what level of involvement (estimated hours) would be available?

Yes, the City has an FTE (full-time equivalent) employee, the Internal Audit Program Manager, whose primary responsibility is to support the co-sourced internal audit provider in their audit work.

2. Are the budgeted fees expected to be inclusive of travel expenses for required site visits?

Yes

3. Does the City have a preferred format for deliverables and reporting?

Yes, written reports in PDF format are preferred for deliverables and reporting. For update presentations to the Audit Committee, slides in PDF, Microsoft PowerPoint, or Google Slides are preferable.

Previous Audit Experience

1. Have there been any significant findings or areas of concern from previous internal audits that we should be aware of?

None - areas of concern identified in previous internal audits are in the process of being addressed.

2. Are there any recent external audit findings (from financial statement audits or other reviews) that might impact the internal audit work?

None

Relevant Links Asheville Business Inclusion Video - important guidance for completing ABI forms in RFP response Recording of Optional Pre-Proposal Meeting held on April 9, 2025

I understand that failure to acknowledge any addenda may cause this bid/proposal to be deemed non-responsive.

Authorized Signature Company Date

- End -https://youtu.be/6Lq54Qx81Oo https://drive.google.com/file/d/1mBCqCro-LiupDl4QtchHlFK3jRSPftU5/view?usp=sharing